SmartTrust: a hybrid deep learning framework for real-time threat detection in cloud environments using Zero-Trust Architecture
Umesh Kumar Lilhore, Sarita Simaiya, Roobaea Alroobaea, Abdullah M. Baqasah, Majed Alsafyani, Afnan Alhazmi, M.M. Khan
Abstract
The rapid growth of cloud computing has brought scalability and flexibility to modern organizations, but it has also introduced a new wave of complex and evolving security threats. Traditional security mechanisms, such as static rule-based systems and Multi-Factor Authentication (MFA), often fall short of identifying advanced attacks like insider threats, privilege escalation, and data breaches. Addressing this gap, we propose SmartTrust, a hybrid deep learning framework designed for real-time threat detection in cloud environments built on Zero-Trust Architecture (ZTA) principles. SmartTrust integrates CNN, LSTM, and Transformer models to analyze spatial and temporal patterns in network traffic and user behaviours. Unlike conventional models, it leverages Reinforcement Learning to enable adaptive decision-making, allowing it to adjust responses based on real-time contextual signals dynamically. To ensure transparency and tamper-proof event tracking, the framework also incorporates blockchain-based logging that is aligned with ZTA compliance. We evaluated SmartTrust on two benchmark datasets, CIC-IoT 2023 and UNSW-NB15, which simulate realistic cloud-based attack scenarios. The model achieved detection rates of 99.19% for insider threats, 98.23% for privilege escalation, and 99.27% for data breaches while reducing false positives by over 40% compared to existing approaches. Though the model’s complexity introduces higher computational demands, its performance demonstrates that SmartTrust offers a robust, intelligent, and adaptive alternative to traditional cloud security solutions capable of evolving with today’s rapidly changing threat landscape.